Bisimulation and coinduction Davide Sangiorgi Focus Lab., INRIA (France) and University of Bologna (Italy) Email: Davide.Sangiorgi@cs.unibo.it http://www.cs.unibo.it/˜sangio/ BASICS 2009, Shanghai
The semantics of processes : – usually operational : (Labelled Transitions Systems, behavioural equivalences) – alternative approach could be the denotational one: a structure-preserving function would map processes into elements of a given semantic domain. Problem: it has often proved very hard to find appropriate semantic domains for these languages Thse lectures : An introduction to the meaning of behavioural equivalence We especially discuss bisimulation, as an instance of the coinduction proof method page 1
Outline From functions to processes Bisimulation Induction and coinduction Weak bisimulation page 2
From processes to functions page 3
Processes? We can think of sequential computations as mathematical objects, namely functions . Concurrent program are not functions, but processes . But what is a process? No universally-accepted mathematical answer. Hence we do not find in mathematics tools/concepts for the denotational semantics of concurrent languages, at least not as successful as those for the sequential ones. page 4
Processes are not functions A sequential imperative language can be viewed as a function from states to states. These two programs denote the same function from states to states: X := 2 and X := 1; X := X + 1 But now take a context with parallelism, such as [ · ] | X := 2 . The program X := 2 | X := 2 always terminates with X = 2 . This is not true (why?) for ( X := 1; X := X + 1 ) | X := 2 Therefore: Viewing processes as functions gives us a notion of equivalence that is not a congruence . In other words, such a semantics of processes as functions would not be compositional . page 5
Furthermore: A concurrent program may not terminate, and yet perform meaningful computations (examples: an operating system, the controllers of a nuclear station or of a railway system). In sequential languages programs that do not terminate are undesirable; they are ‘wrong’. The behaviour of a concurrent program can be non-deterministic. Example: ( X := 1; X := X + 1 ) | X := 2 In a functional approach, non-determinism can be dealt with using powersets and powerdomains. This works for pure non-determinism, as in λx . (3 ⊕ 5) But not for parallelism. page 6
What is a process? When are two processes behaviourally equivalent? These are basic, fundamental, questions; they have been at the core of the research in concurrency theory for the past 30 years. (They are still so today, although remarkable progress has been made) Fundamental for a model or a language on top of which we want to make proofs ... We shall approach these questions from a simple case, in which interactions among processes are just synchronisations, without exchange of values. page 7
Interaction In the example at page 5 X := 2 X := 1; X := X + 1 and should be distinguished because they interact in a different way with the memory. Computation is interaction . Examples: access to a memory cell, interrogating a data base, selecting a programme in a washing machine, .... The participants of an interaction are processes (a cell, a data base, a washing machine, ...) The behaviour of a process should tell us when and how a process can interact with its environment page 8
How to represent interaction: labelled transition systems Definition 1 A labeled transition system (LTS) is a triple ( P , Act , T ) where – P is the set of states , or processes ; – Act is the set of actions ; (NB: can be infinite) – T ⊆ ( P , Act , P ) is the transition relation . µ → P ′ if ( P, µ, P ′ ) ∈ T . Meaning: process P accepts an We write P − interaction with the environment where P performs action µ and then becomes process P ′ . P ′ is a derivative of P if there are P 1 , . . . , P n , µ 1 , . . . , µ n s.t. µ 1 µ n → P n and P n = P ′ . P − → P 1 . . . − page 9
� � � � Example A vending machine, capable of dispensing tea or coffee for 1 coin (1c). The behaviour of the machine is what we can observe, by interacting with the machine. We can represent such a behaviour as an LTS: tea s 3 collect − tea 1 c � s 2 s 1 collect − coffee s 4 coffee ( where s 1 is the initial state) page 10
� � � � � Other examples of LTS (we omit the name of the states) a a � � b � � � � � � � � � � � � � � a b page 11
� � � � � Equivalence of processes An LTS tells us what is the behaviour of processes. When should two behaviours be considered equal? ie, what does it mean that two processes are equivalent? Two processes should be equivalent if we cannot distinguish them by interacting with them. Example (where indicates the processes we are interested in): a b a = b a This shows that graph isomorphism as behavioural equivalence is too strong. A natural alternative (from automata theory): trace equivalence . page 12
� � � � � � � � � � � � � � Examples of trace-equivalent processes: d b a = b � ������������������������� d a c � ������������������������� e a e c a b = a � � � � � � � � � � � � � � � � a b These equalities are OK on automata. But they are not on processes: in one case interacting with the machine can lead to deadlock! page 13
� � � � � � � � � � � For instance, you would not consider these two vending machines ‘the same’: tea collect − tea 1 c collect − tea � ������������������������� 1 c tea collect − coffee � ������������������������� coffee coffee 1 c collect − coffee Trace equivalence (also called language equivalence) is still important in concurrency. Examples: confluent processes; liveness properties such as termination page 14
These examples suggest that the notion of equivalence we seek: – should imply a tighter correspondence between transitions than language equivalence, – should be based on the informations that the transitions convey, and not on the shape of the diagrams. Intuitively, what does it mean for an observer that two machines are equivalent? If you do something with one machine, you must be able to the same with the other, and on the two states which the machines evolve to the same is again true. This is the idea of equivalence that we are going to formalise; it is called bisimilarity . page 15
Bisimulation and bisimilarity We define bisimulation on a single LTS, because: the union of two LTSs is an LTS; we will often want to compare derivatives of the same process. Definition 2 (bisimulation) A relation R on the states of an LTS is a bisimulation if whenever P R Q : → Q ′ and P ′ R Q ′ ; µ µ 1. ∀ µ, P ′ s.t. P → P ′ , then ∃ Q ′ such that Q − − → P ′ and P ′ R Q ′ . µ µ 2. ∀ µ, Q ′ s.t. Q → Q ′ , then ∃ P ′ such that P − − P and Q are bisimilar , written P ∼ Q , if P R Q , for some bisimulation R . R P Q The bisimulation diagram: µ ↓ µ ↓ P ′ Q ′ R page 16
Exercises To prove P ∼ Q you have to find a bisimulation R with P R Q (the bisimulation proof method ) Exercise 3 Prove that the processes at page 12 are bisimilar. Are the processes at page 13 bisimilar? Proposition 4 1. ∼ is an equivalence relation, i.e. the following hold: 1.1. P ∼ P (reflexivity) 1.2. P ∼ Q implies Q ∼ P (symmetry) 1.3. P ∼ Q and Q ∼ R imply P ∼ R (transitivity); 2. ∼ itself is a bisimulation. page 17
Proposition 4(2) suggests an alternative definition of ∼ : Proposition 5 ∼ is the largest relation among the states of the LTS such that P ∼ Q implies: → Q ′ and P ′ ∼ Q ′ ; µ µ 1. ∀ µ, P ′ s.t. P → P ′ , then ∃ Q ′ such that Q − − → P ′ and P ′ ∼ Q ′ . µ µ 2. ∀ µ, Q ′ s.t. Q → Q ′ , then ∃ P ′ such that P − − Exercise 6 Prove Propositions 4-5 (for 4(2) you have to show that ∪{R | R is a bisimulation } is a bisimulation). page 18
We write P ∼R∼ Q if there are P ′ , Q ′ s.t. P ∼ P ′ , P ′ R Q ′ , and Q ′ ∼ Q (and alike for similar notations). Definition 7 (bisimulation up-to ∼ ) A relation R on the states of an LTS is a bisimulation up-to ∼ if P R Q implies: → Q ′ and P ′ ∼R∼ Q ′ . µ µ → P ′ , then there is Q ′ such that Q 1. if P − − µ µ → P ′ and P ′ ∼R∼ Q ′ . → Q ′ , then there is P ′ such that P − − 2. if Q Exercise 8 If R is a bisimulation up-to ∼ then R ⊆∼ . (Hint: prove that ∼ R ∼ is a bisimulation.) page 19
Definition 9 (simulation) A relation R on the states of an LTS is a simulation if P R Q implies: → Q ′ and P ′ R Q ′ . µ µ → P ′ , then there is Q ′ such that Q 1. if P − − P is simulated by Q , written P < Q , if P R Q , for some simulation R . Exercise* 10 Does P ∼ Q imply P < Q and Q < P ? What about the converse? (Hint for the second point: think about the 2nd equality at page 13.) page 20
Recommend
More recommend
